API

.github/workflows/ci.yml

@@ -14,8 +14,6 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: 1.4.2
       - run: bun install --frozen-lockfile
       - run: bun run format:check
 
@@ -24,8 +22,6 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: 1.4.2
       - run: bun install --frozen-lockfile
       - run: bun run lint:check
 
@@ -34,8 +30,6 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: 1.4.2
       - run: bun install --frozen-lockfile
       - run: bun run test:run
 
@@ -44,7 +38,5 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: 1.4.2
       - run: bun install --frozen-lockfile
       - run: bun run typecheck

examples/bun-react/otp-memory-cookie/src/index.css

@@ -1,10 +1,2 @@
 @import "tailwindcss";
 @import "@repo/shared-react/styles.css";
-
-/* Button cursor */
-@layer base {
-  button:not(:disabled),
-  [role="button"]:not(:disabled) {
-    cursor: pointer;
-  }
-}

examples/bun-react/otp-memory-header/src/index.css

@@ -1,10 +1,2 @@
 @import "tailwindcss";
 @import "@repo/shared-react/styles.css";
-
-/* Button cursor */
-@layer base {
-  button:not(:disabled),
-  [role="button"]:not(:disabled) {
-    cursor: pointer;
-  }
-}

examples/convex-react/otp/src/index.css

@@ -1,10 +1,2 @@
 @import "tailwindcss";
 @import "@repo/shared-react/styles.css";
-
-/* Button cursor */
-@layer base {
-  button:not(:disabled),
-  [role="button"]:not(:disabled) {
-    cursor: pointer;
-  }
-}

examples/nextjs/otp-memory/app/globals.css

@@ -1,10 +1,2 @@
 @import "tailwindcss";
 @import "@repo/shared-react/styles.css";
-
-/* Button cursor */
-@layer base {
-  button:not(:disabled),
-  [role="button"]:not(:disabled) {
-    cursor: pointer;
-  }
-}

examples/shared/react/src/styles.css

@@ -1 +1,8 @@
 @source ".";
+
+@layer base {
+  button:not(:disabled),
+  [role="button"]:not(:disabled) {
+    cursor: pointer;
+  }
+}

examples/tanstack-start-react/otp-memory/package.json

@@ -10,8 +10,8 @@
     "typecheck": "tsc"
   },
   "dependencies": {
-    "authax": "workspace:*",
     "@repo/shared-react": "workspace:*",
+    "@repo/spike": "workspace:*",
     "@tailwindcss/vite": "^4.3.3",
     "@tanstack/react-router": "^1.170.39",
     "@tanstack/react-start": "^1.168.58",

examples/tanstack-start-react/otp-memory/src/auth-rpc.ts

@@ -1,9 +1,16 @@
 import { createServerFn } from "@tanstack/react-start";
 import { z } from "zod";
 import { db } from "./db";
-import { auth, emailOtp } from "./auth";
+import { emailOtp, sessionManager } from "./auth";
 import { sessionCookie } from "./session-cookie";
 
+/** The session behind the request's cookie, null when there is none */
+async function getIdentity() {
+  const token = sessionCookie.get();
+
+  return token === null ? null : sessionManager.get(token);
+}
+
 /**
  * Request OTP schema
  */
@@ -15,34 +22,47 @@ export const requestOtpSchema = z.object({
  * Verify OTP schema
  */
 export const verifyOtpSchema = z.object({
-  identifier: z.email(),
+  ticket: z.string(),
   otp: z.string().length(6),
 });
 
 /**
  * Send OTP to identifier server function
+ *
+ * Returns the ticket the client sends back with the OTP.
  */
 export const requestOtp = createServerFn({ method: "POST" })
   .validator(requestOtpSchema)
-  .handler(({ data }) => auth.strategies.email.request(data));
+  .handler(async ({ data }) => ({
+    success: true,
+    ticket: await emailOtp.send(data.identifier),
+  }));
 
 /**
  * Verify OTP server function
  *
- * Authenticates with the OTP, which upserts the user and establishes a
+ * Authenticates with the OTP, finds or creates the user, and establishes a
  * session. Returns isNew to distinguish sign-up from sign-in (for analytics,
  * onboarding, etc.).
  */
 export const verifyOtp = createServerFn({ method: "POST" })
   .validator(verifyOtpSchema)
   .handler(async ({ data }) => {
-    const result = await auth.strategies.email.authenticate(data);
+    const result = await emailOtp.verify(data);
 
     if (!result.success) return { success: false };
 
-    sessionCookie.set(result.data.session.token, result.data.session.expiresAt);
+    const { identifier } = result.data.proven;
+    const { row: user, isNew } = await db.users.findOrInsert(
+      { email: identifier },
+      { userId: crypto.randomUUID(), email: identifier },
+    );
+
+    sessionCookie.set(
+      await sessionManager.make(result.data, { userId: user.userId }),
+    );
 
-    return { success: true, isNew: result.data.user.isNew };
+    return { success: true, isNew };
   });
 
 /**
@@ -54,13 +74,16 @@ export const verifyOtp = createServerFn({ method: "POST" })
 export const changeEmail = createServerFn({ method: "POST" })
   .validator(verifyOtpSchema)
   .handler(async ({ data }) => {
-    const identity = await auth.session.get(sessionCookie.get());
+    const identity = await getIdentity();
     if (!identity) return { success: false };
 
-    const verified = await emailOtp.verify(data.identifier, data.otp);
-    if (!verified) return { success: false };
+    const verified = await emailOtp.verify(data);
+    if (!verified.success) return { success: false };
 
-    const user = db.users.updateEmail(identity.userId, data.identifier);
+    const user = await db.users.updateEmail(
+      identity.userId,
+      verified.data.proven.identifier,
+    );
     if (!user) return { success: false };
 
     return { success: true, viewer: user };
@@ -72,7 +95,9 @@ export const changeEmail = createServerFn({ method: "POST" })
  * Ends the current session and clears the session cookie.
  */
 export const signOut = createServerFn({ method: "POST" }).handler(async () => {
-  await auth.session.end(sessionCookie.get());
+  const token = sessionCookie.get();
+
+  if (token !== null) await sessionManager.end(token);
   sessionCookie.clear();
 });
 
@@ -83,8 +108,8 @@ export const signOut = createServerFn({ method: "POST" }).handler(async () => {
  */
 export const signOutAll = createServerFn({ method: "POST" }).handler(
   async () => {
-    const identity = await auth.session.get(sessionCookie.get());
-    if (identity) db.sessions.deleteAllForUser(identity.userId);
+    const identity = await getIdentity();
+    if (identity) await db.sessions.deleteAllForUser(identity.userId);
     sessionCookie.clear();
   },
 );
@@ -95,7 +120,7 @@ export const signOutAll = createServerFn({ method: "POST" }).handler(
  * Returns the current user if authenticated, or null otherwise.
  */
 export const getViewer = createServerFn().handler(async () => {
-  const identity = await auth.session.get(sessionCookie.get());
+  const identity = await getIdentity();
 
-  return identity ? (db.users.get(identity.userId) ?? null) : null;
+  return identity ? db.users.get(identity.userId) : null;
 });

examples/tanstack-start-react/otp-memory/src/auth.ts

@@ -1,34 +1,55 @@
-import { makeAuth, makeOpaqueSession, makeOtp, makeOtpStrategy } from "authax";
+import { makeOpaqueSessionManager, makeOTP } from "@repo/spike";
 import { db } from "./db";
 
-const session = makeOpaqueSession({
-  storage: db.sessions,
-  ttl: 30 * 24 * 60 * 60 * 1000,
+/** How long someone stays signed in, in ms. The cookie lives as long. */
+export const sessionTtl = 30 * 24 * 60 * 60 * 1000;
+
+export const sessionManager = makeOpaqueSessionManager<{ userId: string }>({
+  store: async (token, row) => {
+    await db.sessions.insert({
+      id: token,
+      userId: row.userId,
+      expiresAt: new Date(row.expiresAt),
+    });
+  },
+  get: async (token) => {
+    const row = await db.sessions.get(token);
+
+    return row
+      ? { userId: row.userId, expiresAt: row.expiresAt.getTime() }
+      : null;
+  },
+  delete: async (token) => {
+    await db.sessions.delete(token);
+  },
+  ttl: sessionTtl,
 });
 
-export const emailOtp = makeOtp({
-  storage: db.otps,
-  delivery: {
-    send: async (identifier, otp) => {
-      console.log(`[OTP] ${identifier}: ${otp}`);
-    },
+export const emailOtp = makeOTP({
+  store: async (ticket, row) => {
+    await db.otps.insert({
+      id: ticket,
+      email: row.identifier,
+      otp: row.otp,
+      expiresAt: new Date(row.expiresAt),
+      attemptsLeft: row.attemptsLeft,
+    });
+  },
+  take: async (ticket) => {
+    const row = await db.otps.delete(ticket);
+
+    return row
+      ? {
+          identifier: row.email,
+          otp: row.otp,
+          expiresAt: row.expiresAt.getTime(),
+          attemptsLeft: row.attemptsLeft,
+        }
+      : null;
+  },
+  send: async (identifier, otp) => {
+    console.log(`[OTP] ${identifier}: ${otp}`);
   },
   ttl: 10 * 60 * 1000,
   attempts: 3,
 });
-
-export const auth = makeAuth(session, (kernel) => ({
-  email: makeOtpStrategy(kernel, {
-    request: async ({ identifier }) => {
-      await emailOtp.request(identifier);
-      return { success: true };
-    },
-    authenticate: async ({ identifier, otp }) => {
-      if (!(await emailOtp.verify(identifier, otp))) {
-        return { success: false, error: "invalid_otp" };
-      }
-
-      return { success: true, data: db.users.upsert(identifier) };
-    },
-  }),
-}));